Who Is Hacking U.S. Banks? 8 Facts

Hackers have labeled the bank website disruptions as grassroots-level reprisal for an anti-Islamic film. But is the Iranian government really backing the attacks?

1 of 8

Who's behind the recent online attacks against U.S. banks? A Muslim hacktivist group calling itself the Cyber fighters of Izz ad-din Al qassam continues to take credit for the campaign of website disruptions. In recent weeks, its distributed denial-of-service (DDoS) attacks, launched under the banner of "Operation Ababil," have disrupted the websites of some of Wall Street's biggest financial institutions, including Bank of America, BB&T, JPMorgan Chase, Capital One, HSBC, New York Stock Exchange, Regions Financial, SunTrust, U.S. Bank, and Wells Fargo.

The hacktivist group's name refers to "Izz ad-Din al-Qassam, a Muslim holy man who fought against European forces and Jewish settlers in the Middle East in the 1920s and 1930s," according to The New York Times. In a similar vein, the website disruptions have been portrayed by some backers as a spontaneous, grassroots-driven online protest. But the actual identity of the attackers, as well as their motives or backing, remain the subject of much debate. Notably, U.S. officials--speaking anonymously in media interviews--have alleged that the group, despite what its own anonymous public pronouncements might claim, is nothing more than a front for an operation that's being run by the Iranian government.

In a series of Pastebin posts, the hacktivists have typically previewed which banks they'll be disrupting, as well as the dates and times of planned attacks. At the same time, they've broadly denied U.S. government officials' assertions, including allegations that the group has been involved in recent attacks that employed malware to obtain credentials for U.S. bank websites, allowing attackers to wire money from U.S. to overseas bank accounts, stealing up to $900,000 in one go.

So, what do the attackers want? According to their Pastebin pronouncements, their goal is relatively simple: they want to see the Innocence of Muslims film that mocks the founder of Islam removed from the Internet. A 14-minute clip of the film first surfaced on YouTube in July 2012, parts of which were broadcast on Egyptian television on Sept. 9, 2012.

The film has been attributed to Nakoula Basseley Nakoula (a.k.a. Mark Basseley Youssef), 55, who was recently arrested in the United States on parole violations, which could see him returned to jail for two years. Nakoula, an Egyptian-born U.S. resident, was on parole after serving prison time for his 2010 conviction on bank fraud charges, and his alleged parole violations include using aliases, using a computer without supervision, and lying to his probation officer. Nakoula, however, has denied all charges against him. He's due back in court next month.

In the meantime, the attacks on banking websites show no signs of stopping.

Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.

A vulnerability in DB Manager version 3.0.1.0 and previous and PerformA version 3.0.0.0 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in data corrup...

A vulnerability in ReadA version 1.1.0.2 and previous allows an authorized user with access to a privileged account on a BD Kiestra system (Kiestra TLA, Kiestra WCA, and InoqulA+ specimen processor) to issue SQL commands, which may result in loss or corruption of data.

Stored cross-site scripting (XSS) vulnerability in the &quot;Site Name&quot; field found in the &quot;site&quot; tab under configurations in ClipperCMS 1.3.3 allows remote attackers to inject arbitrary web script or HTML via a crafted site name to the manager/processors/save_settings.processor.php f...

In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class type before calling newInstance in deserialization.

Some Huawei smart phones with the versions before Berlin-L21HNC185B381; the versions before Prague-AL00AC00B223; the versions before Prague-AL00BC00B223; the versions before Prague-AL00CC00B223; the versions before Prague-L31C432B208; the versions before Prague-TL00AC01B223; the versions before Prag...